Serial No.: 09/552,878 
Art Unit: 2157 



Attorney's Docket No.: MAN0002-US 

Page 13 



REMARKS 



Reconsideration of this application is respectfully requested in view of the foregoing 
amendment and the following remarks. 

Claims 1-7, 9-11, 13, 14, 16-34, 36-38, and 40-54 were pending in this application. In 
this Amendment, claims 20 and 47 have been cancelled, claims 40-41 have been amended to 
correct their dependencies, and independent claims 1 and 28 have been amended to recite the 
subject matter of cancelled claims 20 and 47, respectively. Accordingly, no new matter has been 
entered and no new issues have been raised. Claims 1-7, 9-11, 13, 14, 16-19, 21-34, 36-38, and 
40-54 will be pending herein upon entry of this Amendment. For the reasons stated below, 
Applicants respectfully submit that all claims pending in this application are in condition for 
allowance. 

On the Office Action Summary page it is indicated that the drawings are objected to by 
the Examiner. However, it is not clear what the objection is. On page 2 of the Office Action it is 
indicated that "Fig. 2-4" were not submitted. Fig. 1 was previously submitted as a replacement 
drawing sheet. Remaining Figs. 2-5 of the application appear on different sheets and, thus, need 
not have been resubmitted with the drawing correction of Fig. 1 . Unless something more is 
being required, Applicants will file formal drawings in this application upon receiving a Notice 
of Allowance. 

Further in the Office Action, claims 1-7, 9-11,13-14, 16-18, 20-34, 36-38, and 40-54 
were rejected under 35 U.S.C. § 102(e) as allegedly being anticipated by U.S. Patent 5,796,942 to 
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Esbensen. To the extent this rejection might still be applied to claims presently pending in this 
application, it is respectfully traversed. 

The present invention is directed to a system and method for analyzing data traveling 
through a network. In accordance with the present invention, a data stream is collected and 
resolved into logical groupings, typically made up of a plurality of packets. These packets are 
then assembled into respective sessions to recreate, where possible, a complete session between 
two end points, i.e., two computers. It is upon these assembled sessions or "session objects" that 
a lexical engine operates to identify one or more network events. In accordance with the 
amendments made to independent claims 1 and 28, the lexical engine is operated "recursively." 
As explained in the paragraph beginning at page 12, line 33 of the present application 



Because network protocols may be nested, for example, a POP-3 
session may contain one or more instances of RFC822 email 
sessions, application sensor 126 may be applied recursively to 
identify protocols within other protocols to extract nested or 
underlying objects encapsulated in one or more different protocols. 



This feature is neither disclosed nor suggested by Esbensen. Specifically, the Office 
Action relies heavily on col. 5, lines 15-55 of Esbensen as allegedly disclosing multiple features 
of the claimed invention, including the "recursive" features originally recited in claims 20 and 
47. This passage of Esbensen, however, in fact discloses nothing regarding a recursive 
application of a lexical engine by an event sensor, let alone doing so to extract nested or 
underlying objects encapsulated in one or more different protocols. 
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For at least these reasons, Applicants respectfully submit that the independent claims, as 
amended, along with the remaining dependent claims, are patentable over Esbensen. 
Reconsideration and withdrawal of the §102 rejection is accordingly urged. 

In view of the foregoing all of the claims in this case are believed to be in condition for 
allowance. Should the Examiner have any questions or determine that any further action is 
desirable to place this application in even better condition for issue, the Examiner is encouraged 
to telephone applicants' undersigned representative at the number listed below. 
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